Buggy code:
private static RefType IBINDER_TYPE = RefType . v ( "android.os.IBinder" ) ; private Map < String , SootMethod > source2RedirectMethod = new HashMap < String , SootMethod > ( ) ; private Map < String , SootClass > destination2sootClass = new HashMap < String , SootClass > ( ) ; private static ICCRedirectionCreator s = null ; private ICCRedirectionCreator ( ) { } public static ICCRedirectionCreator v ( String pkg ) { } public static ICCRedirectionCreator v ( ) { } public void redirectToDestination ( ICCLink link ) { } public SootMethod getRedirectMethod ( ICCLink link ) { } public SootMethod generateRedirectMethodForStartActivityForResult ( SootClass originActivity , SootClass destComp ) { } public SootMethod generateRedirectMethod ( SootClass wrapper ) { } public SootMethod generateRedirectMethodForStartActivity ( SootClass wrapper ) { } public SootMethod generateRedirectMethodForBindService ( SootClass serviceConnection , SootClass destComp ) { String newSM_name = "redirector" + ( ( ICCRedirectionCreator . num ) ++ ) ; List < Type > newSM_parameters = new ArrayList < Type > ( ) ; newSM_parameters . add ( serviceConnection . getType ( ) ) ; newSM_parameters . add ( ICCRedirectionCreator . INTENT_TYPE ) ; Type newSM_return_type = VoidType . v ( ) ; int modifiers = ( Modifier . STATIC ) | ( Modifier . PUBLIC ) ; SootMethod newSM = new SootMethod ( newSM_name , newSM_parameters , newSM_return_type , modifiers ) ; ICCRedirectionCreator . ipcSC . addMethod ( newSM ) ; JimpleBody b = Jimple . v ( ) . newBody ( newSM ) ; newSM . setActiveBody ( b ) ; LocalGenerator lg = new LocalGenerator ( b ) ; Local originActivityParameterLocal = lg . generateLocal ( serviceConnection . getType ( ) ) ; Unit originActivityParameterU = Jimple . v ( ) . newIdentityStmt ( originActivityParameterLocal , Jimple . v ( ) . newParameterRef ( serviceConnection . getType ( ) , 0 ) ) ; Local intentParameterLocal = lg . generateLocal ( ICCRedirectionCreator . INTENT_TYPE ) ; Unit intentParameterU = Jimple . v ( ) . newIdentityStmt ( intentParameterLocal , Jimple . v ( ) . newParameterRef ( ICCRedirectionCreator . INTENT_TYPE , 1 ) ) ; Local destCompLocal = lg . generateLocal ( destComp . getType ( ) ) ; Unit newU = ( ( Unit ) ( Jimple . v ( ) . newAssignStmt ( destCompLocal , Jimple . v ( ) . newNewExpr ( destComp . getType ( ) ) ) ) ) ; List < Type > parameters = new ArrayList < Type > ( ) ; parameters . add ( ICCRedirectionCreator . INTENT_TYPE ) ; SootMethod method = destComp . getMethod ( "<init>" , parameters , VoidType . v ( ) ) ; List < Value > args = new ArrayList < Value > ( ) ; args . add ( intentParameterLocal ) ; Unit initU = ( ( Unit ) ( Jimple . v ( ) . newInvokeStmt ( Jimple . v ( ) . newSpecialInvokeExpr ( destCompLocal , method . makeRef ( ) , args ) ) ) ) ; List < SootMethod > sms = destComp . getMethods ( ) ; for ( SootMethod sm : sms ) { System . out . println ( sm ) ; } method = destComp . getMethodByName ( DUMMY_MAIN_METHOD ) ; InvokeExpr invoke = Jimple . v ( ) . newVirtualInvokeExpr ( destCompLocal , method . makeRef ( ) ) ; Unit callU = ( ( Unit ) ( Jimple . v ( ) . newInvokeStmt ( invoke ) ) ) ; method = destComp . getMethodByName ( "getIBinderForIpc" ) ; Type binderType = method . getReturnType ( ) ; Local ibinderLocal = lg . generateLocal ( binderType ) ; Unit nullarIntentLocalParamU = ( ( Unit ) ( Jimple . v ( ) . newAssignStmt ( ibinderLocal , NullConstant . v ( ) ) ) ) ; invoke = Jimple . v ( ) . newVirtualInvokeExpr ( destCompLocal , method . makeRef ( ) ) ; Unit destCompCallU = ( ( Unit ) ( Jimple . v ( ) . newAssignStmt ( ibinderLocal , invoke ) ) ) ; method = serviceConnection . getMethodByName ( "onServiceConnected" ) ; changeParameterType ( method , ICCRedirectionCreator . IBINDER_TYPE , binderType ) ; <START_BUG> Local iLocal1 = lg . generateLocal ( NullType . v ( ) ) ; <END_BUG> Unit defaultValueParamU1 = ( ( Unit ) ( Jimple . v ( ) . newAssignStmt ( iLocal1 , NullConstant . v ( ) ) ) ) ; args = new ArrayList < Value > ( ) ; args . add ( iLocal1 ) ; args . add ( ibinderLocal ) ; invoke = Jimple . v ( ) . newVirtualInvokeExpr ( originActivityParameterLocal , method . makeRef ( ) , args ) ; Unit onActivityResultCall = ( ( Unit ) ( Jimple . v ( ) . newInvokeStmt ( invoke ) ) ) ; b . getUnits ( ) . add ( originActivityParameterU ) ; b . getUnits ( ) . add ( intentParameterU ) ; b . getUnits ( ) . add ( newU ) ; b . getUnits ( ) . add ( initU ) ; b . getUnits ( ) . add ( callU ) ; b . getUnits ( ) . add ( nullarIntentLocalParamU ) ; b . getUnits ( ) . add ( destCompCallU ) ; b . getUnits ( ) . add ( defaultValueParamU1 ) ; b . getUnits ( ) . add ( onActivityResultCall ) ; b . getUnits ( ) . add ( Jimple . v ( ) . newReturnVoidStmt ( ) ) ; System . out . println ( ( ( ( "new<seq2seq4repair_space>lifecypcle<seq2seq4repair_space>method:<seq2seq4repair_space>" + newSM ) + "<seq2seq4repair_space>body:<seq2seq4repair_space>" ) + ( newSM . retrieveActiveBody ( ) ) ) ) ; return newSM ; } public void changeParameterType ( SootMethod sm , Type originalType , Type newType ) { } public SootMethod generateFakeOnActivityResult ( SootClass sootClass ) { } public SootMethod generateRedirectMethodForContentProvider ( Stmt iccStmt , SootClass destProvider ) { } }

Fix:
Local iLocal1 = lg . generateLocal ( RefType . v ( "java.lang.Object" ) ) ;